Detecting and Analyzing an Apache Struts Exploit with Tracee

The report presents a Tracee-based runtime forensic analysis of an Apache Struts 2 RCE (CVE-2017-5638) compromise: attackers executed a downloaded shell script that disabled defenses, removed competing processes, retrieved a UPX-packed cryptominer from a C2, attempted credential harvesting and SSH/Redis lateral scans, and performed actions to hide evidence; Tracee captured the exploit HTTP requests, execve events, file artifacts, network scanning behavior, and attempted kernel module loading to boost mining performance.